Introduction to Wireless Intrusion Detection Systems

The IDS (Intrusion Detection System) is a common means of protecting networked systems from attack or malicious misuse. The development and rollout of an IDS can take many different forms in terms of equipment, protocols, connectivity, cost and automation. This is particularly true of WIDS (Wireless Intrusion Detection Systems) which have many more opportunities and challenges associated with data transmission through an open, shared medium.
The operation of a WIDS is a multistep process from origination of an attack through to human readable evaluation. Attention to the performance of each of the processes in the chain from attack detection to evaluation is imperative if an optimum solution is to be sought. At present, research focuses very much on each discrete aspect of a WIDS with little consideration to the operation of the whole system. Taking a holistic view of the technology shows the interconnectivity and inter-dependence between stages, leading to improvements and novel research areas for investigation.
This chapter will outline the general structure of Wireless Intrusion Detection Systems and briefly describe the functions of each development stage, categorised into the following 6 areas:
• Threat Identification,
• Architecture,
• Data Collection,
• Intrusion Detection,
• Alert Correlation,
• Evaluation.
These topics will be considered in broad terms designed for those new to the area. Focus will be placed on ensuring the readers are aware of the impact of choices made at early stages in WIDS development on future stages.

Rule-Based Intrusion Detection System for SCADA Networks

Increased complexity and interconnectivity of Supervisory Control and Data Acquisition (SCADA) systems in Smart Grids potentially means greater susceptibility to malicious attackers. SCADA systems with legacy communication infrastructure have inherent cyber-security vulnerabilities as these systems were originally designed with little consideration of cyber threats. In order to improve cyber-security of SCADA networks, this paper presents a rule-based Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method, which includes signature-based and model-based approaches tailored for SCADA systems. The proposed signature-based rules can accurately detect several known suspicious or malicious attacks. In addition, model-based detection is proposed as a complementary method to detect unknown attacks. Finally, proposed intrusion detection approaches for SCADA networks are implemented and verified using a ruled based method.

Intrusion Detection System for Network Security in Synchrophasor Systems

Synchrophasor systems will play a crucial role in next generation Smart Grid monitoring, protection and control. However these systems also introduce a multitude of potential vulnerabilities from malicious and inadvertent attacks, which may render erroneous operation or severe damage. This paper proposes a Synchrophasor Specific Intrusion Detection System (SSIDS) for malicious cyber attack and unintended misuse. The SSIDS comprises a heterogeneous whitelist and behavior-based approach to detect known attack types and unknown and so-called ‘zero-day’ vulnerabilities and attacks. The paper describes reconnaissance, Man-in-the-Middle (MITM) and Denial-of-Service (DoS) attack types executed against a practical synchrophasor system which are used to validate the real-time effectiveness of the proposed SSIDS cyber detection method.

Intrusion Detection System for IEC 60870-5-104 Based SCADA Networks

Increased complexity and interconnectivity of Supervisory Control and Data Acquisition (SCADA) systems in Smart Grids potentially means greater susceptibility to malicious attackers. SCADA systems with legacy communication infrastructure have inherent cyber-security vulnerabilities as these systems were originally designed with little consideration of cyber threats. In order to improve cyber-security of SCADA networks, this paper presents a rule-based Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method, which includes signature-based and model-based approaches tailored for SCADA systems. The proposed signature-based rules can accurately detect several known suspicious or malicious attacks. In addition, model-based detection is proposed as a complementary method to detect unknown attacks. Finally, proposed intrusion detection approaches for SCADA networks are implemented and verified via Snort rules.

Multi-Attribute SCADA-Specific Intrusion Detection System for Power Networks

The increased interconnectivity and complexity of supervisory control and data acquisition (SCADA) systems in power system networks has exposed the systems to a multitude of potential vulnerabilities. In this paper, we present a novel approach for a next-generation SCADA-specific intrusion detection system (IDS). The proposed system analyzes multiple attributes in order to provide a comprehensive solution that is able to mitigate varied cyber-attack threats. The multiattribute IDS comprises a heterogeneous white list and behavior-based concept in order to make SCADA cybersystems more secure. This paper also proposes a multilayer cyber-security framework based on IDS for protecting SCADA cybersecurity in smart grids without compromising the availability of normal data. In addition, this paper presents a SCADA-specific cybersecurity testbed to investigate simulated attacks, which has been used in this paper to validate the proposed approach.

Poly[mercury(II)-di-mu-chloro-mu-pyrazine-kappa N-2 : N ']

In [HgCl2(Pyp)](n) (Pyp = pyrazine, C4H4N2), chloride-bridged HgCl4/2 strands are connected into layers by pyrazine molecules. The Hg atom is on a site of symmetry 2/m, the unique Cl atom is on a mirror plane, the unique N atom is on a twofold rotation axis, and the unique C and H atoms are in general positions.

catena-poly[mercury(II)-di-mu-chloro-mu-pyridazine-kappa N-2 : N ']

The crystal structure of [HgCl2(Pyo)](n) (Pyo = pyridazine, C4H4N2) consists of chloride-bridged strands of octahedrally coordinated mercuric centers, connected by the two neighboring N atoms of pyridazine molecules. All atoms lie in special positions:Hg with site symmetry 2/m and the others on mirror planes.

catena-poly[mercury(II)-di-mu-bromo-mu-pyridazine-kappa N-2 : N ']

The crystal structure of [HgBr2(Pyo)](n) (Pyo = pyridazine, C4H4N2) consists of strands of octahedrally coordinated mercuric centers asymmetrically bridged by bromide and connected by the two neighboring N atoms of pyridazine molecules to complete the octahedral coordination of mercury. The Hg atoms lie on inversion centers.

Stochastic Analysis of Saltwater Intrusion in Heterogeneous Aquifers using Local Average Subdivision

This study investigates the effects of ground heterogeneity, considering permeability as a random variable, on an intruding SW wedge using Monte Carlo simulations. Random permeability fields were generated, using the method of Local Average Subdivision (LAS), based on a lognormal probability density function. The LAS method allows the creation of spatially correlated random fields, generated using coefficients of variation (COV) and horizontal and vertical scales of fluctuation (SOF). The numerical modelling code SUTRA was employed to solve the coupled flow and transport problem. The well-defined 2D dispersive Henry problem was used as the test case for the method. The intruding SW wedge is defined by two key parameters, the toe penetration length (TL) and the width of mixing zone (WMZ). These parameters were compared to the results of a homogeneous case simulated using effective permeability values. The simulation results revealed: (1) an increase in COV resulted in a seaward movement of TL; (2) the WMZ extended with increasing COV; (3) a general increase in horizontal and vertical SOF produced a seaward movement of TL, with the WMZ increasing slightly; (4) as the anisotropic ratio increased the TL intruded further inland and the WMZ reduced in size. The results show that for large values of COV, effective permeability parameters are inadequate at reproducing the effects of heterogeneity on SW intrusion.

Experimental Investigation of Transient Saltwater Intrusion in Heterogeneous Porous Media

A 2D sandbox style experiment was developed to compare the results of numerical modelling to physical testing for saltwater intrusion in homogeneous and heterogeneous aquifers. The sandbox consisted of a thin central viewing chamber filled with glass beads of varying diameters (780μm, 1090μm and 1325μm) under fully saturated conditions. Dyed saltwater (SW) was introduced at the side boundary and a head difference imposed across the porous media. Images of the SW wedge were recorded at intervals in order to assess the suitability of the numerical models predictions of transient SW intrusion. Numerical modelling of the experimental cases were simulated using SUTRA. Two main parameters were chosen to express the condition of the intruding SW wedge at each recorded time step; the toe penetration length (TL) and the width of the mixing zone (WMZ). The WMZ was larger under transient conditions in the heterogeneous case, while the TL was longer for the homogeneous case. The increased variability in the flow field fo the heterogeneous case resulted in increased dispersion, and thus, increased WMZ.

An ionic liquid process for mercury removal from natural gas

Efficient scrubbing of mercury vapour from natural gas streams has been demonstrated both in the laboratory and on an industrial scale, using chlorocuprate(ii) ionic liquids impregnated on high surface area porous solid supports, resulting in the effective removal of mercury vapour from natural gas streams. This material has been commercialised for use within the petroleum gas production industry, and has currently been running continuously for three years on a natural gas plant in Malaysia. Here we report on the chemistry underlying this process, and demonstrate the transfer of this technology from gram to ton scale.

Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security

Cyber threats in Supervisory Control and Data Acquisition (SCADA) systems have the potential to render physical damage and jeopardize power system operation, safety and stability. SCADA systems were originally designed with little consideration of escalating cyber threats and hence the problem of how to develop robust intrusion detection technologies to tailor the requirements of SCADA is an emerging topic and a big challenge. This paper proposes a stateful Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method to improve the cyber-security of SCADA systems using the IEC 60870-5-104 protocol which is tailored for basic telecontrol communications. The proposed stateful protocol analysis approach is presented that is designed specifically for the IEC 60870-5-104 protocol. Finally, the novel intrusion detection approach are implemented and validated.